LDAP Extended Identity Workflows

Build helpers that exercise extended directory operations to confirm authentication context, rotate credentials, fetch paginated search results, and observe live updates.

Capabilities

Report authenticated identity

• After establishing a session with provided host, bind DN, and password, retrieving the server-reported authenticated identity returns the expected DN string. @test

Rotate user password

• Updating a user's password with given old and new secrets succeeds, and a follow-up bind using the new password for that DN confirms the change. @test

Collect paginated search results

• When the directory enforces small page sizes, performing a search under a base DN with a filter returns all entries across pages, aggregated into a single list of attribute dictionaries sorted by DN to keep ordering deterministic. @test

Stream directory changes

• Listening for modifications under a base DN with a provided filter yields callbacks for each change during a short observation window, and the function returns a summary of the events captured. @test

Implementation

@generates

API

from collections.abc import Callable
from typing import Any

def fetch_bound_identity(config: dict[str, Any]) -> str:
    """
    Opens a directory session using config (host, credentials, TLS and other options)
    and returns the server's reported identity for the bound user.
    """


def rotate_password(config: dict[str, Any], target_dn: str, old_password: str, new_password: str) -> bool:
    """
    Updates the target user's password using extended operations and verifies the
    change by attempting a bind with the new password.
    """


def paged_lookup(config: dict[str, Any], base_dn: str, search_filter: str, attributes: list[str]) -> list[dict[str, Any]]:
    """
    Executes a paginated search and returns all entries as dictionaries containing
    only the requested attributes, sorted by DN.
    """


def monitor_changes(
    config: dict[str, Any],
    base_dn: str,
    search_filter: str,
    on_event: Callable[[dict[str, Any]], None],
    runtime_seconds: int = 5,
) -> list[dict[str, Any]]:
    """
    Runs a persistent search for the given interval, invokes on_event for each change
    in the order they arrive, and returns a list of the change payloads observed.
    """

Dependencies { .dependencies }

ldap3 { .dependency }

Provides LDAP client features, including extended operations for identity reporting, credential changes, paged searches, and persistent search streams.

@satisfied-by